The vulnerability is a use‑after‑free that remains after an incomplete fix to a prior security issue. Remote authenticated peers can send specially crafted packets during TLS session promotion or session expiry to trigger the flaw, potentially causing the OpenVPN server to crash or leaking memory contents. The flaw is limited to authenticated peers, but once exploited it can interrupt service availability or expose sensitive data from the server’s memory space.

The affected product is OpenVPN, specifically the OpenVPN 2.6 family from versions 2.6.0 through 2.6.22 and the 2.7 alpha releases from 2.7_alpha1 through 2.7.7.

The CVSS score of 7.2 indicates a moderate to high impact severity. The EPSS score is < 1%, indicating a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated peer and the opportunity to manipulate packet contents during TLS session promotion or expiry; an attacker could create crafted packets to trigger a crash or leak memory, leading to service interruption or disclosure of confidential data.